Chrome brings device-bound sessions to Windows users

Google announced on 9 April that Device Bound Session Credentials were entering public availability for Windows users on Chrome 146. Its security announcement said macOS support was planned for an upcoming release.

DBSC binds a signed-in session to a device using a private key protected by hardware, such as a Windows Trusted Platform Module. Chrome must demonstrate possession of that key before a website issues fresh, short-lived session cookies. A copied cookie can therefore lose its usefulness when it expires.

The feature addresses the period after sign-in, when malware can steal cookies without needing an account’s password. Websites need to support the protocol; browser availability alone does not establish that every account is protected.

Google said each session has a separate key and that the protocol avoids sharing device identifiers beyond the necessary public key. It reported reduced session theft for protected sessions without publishing a percentage in the announcement. Broader device support remained an area of development.